Elastic Defend: Container Workload Protection Alert Aggregation
This rule provides a centralized detection mechanism for container-based threats captured by the Cloud Defend integration, targeting suspicious activity within orchestrated Linux environments.
Triage facts
Revision 1- Applicability
- Elastic Defend for Containers
- Evidence
- Unknown
- Severity
- Medium
- Action
- Monitor or close
- Sources
- 1 public source
- Freshness
- Revision 1Nov 3, 21:45 UTC
- Source quality
- B2Roughly even chance
The Elastic Defend for Containers integration provides visibility into container runtime threats, including potential container escapes, unauthorized access attempts, and orchestration anomalies. This detection rule serves as an aggregator for the logs-cloud_defend.alerts-* index, facilitating triage of alerts generated by the cloud defense module on Linux-based container hosts.
Impact
Successful exploitation of containerized workloads can lead to unauthorized access to host systems, lateral movement within the container infrastructure, and disruption of containerized services.
Recommendation
- Deploy the aggregate detection rule to your Elastic Security instance to capture alerts from the
cloud_defendmodule. - Baseline routine activities such as automated CI/CD deployments and scheduled maintenance tasks to create exceptions.
- Implement network segmentation and access controls to restrict exposure of the container orchestration plane.
- Configure alerts to trigger investigation workflows when events are received from
logs-cloud_defend.alerts-*.
Threat Hunt
Identify high-frequency noise from CI/CD pipelines or maintenance tasks to refine alert signal
Data: event.module: cloud_defend, process.executable, user.name
Mitigations
Implement network segmentation and container isolation policies
Lateral movement within containerized environments